topic Re: HTTPS Traffic Accepted via Implied Rules in General Topics

HTTPS Traffic Accepted via Implied Rules

RemoteUser — Tue, 02 Dec 2025 08:07:54 GMT

Dear mates,

The customer pointed out that a large amount of HTTPS traffic from external public IPs is being accepted by implied rules on the firewall. What could be the reason for this?

Is there any implied rule that allows HTTPS by default?
And in which scenarios should this behavior be considered a concern?

Thanks in advance, as always!

Re: HTTPS Traffic Accepted via Implied Rules

Chris_Atkinson — Tue, 02 Dec 2025 08:36:57 GMT

There are several SK articles and previous threads here that describe this scenario e.g.

sk105740: HTTP and HTTPS requests to external interfaces create implied rule 0 accepts in Logs & Monitor

sk180808: Security Gateway accepts HTTP/HTTPS traffic by an implied rule for its HTTP/HTTPS Web Portals, although there is an explicit rule to drop this HTTP/HTTPS traffic

Re: HTTPS Traffic Accepted via Implied Rules

Vincent_Bacher — Tue, 02 Dec 2025 11:44:07 GMT

In addition, if someone wants to understand what is happening, I would suggest temporarily enabling logging for implied rules. When I first started working with Check Point, this was very useful for me.
https://support.checkpoint.com/results/sk/sk110218

Re: HTTPS Traffic Accepted via Implied Rules

the_rock — Thu, 04 Dec 2025 01:01:33 GMT

Hey brother,

Apart what the guys said, which is all correct, here is what I would recommend. Create a geo block rule on top of the rule base to limit access from countries you wish to block, then below that, rule that allows access to the fw on whatever services needed. Thats how I do it with literally every customer. Then, down the rulebase, you can set up stealth rule, which is src any, dst fw, service any, action drop.